CVE-2019-19683: Path Traversal

Published Dec 9, 2019

Updated

RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to ../ path traversal via d or f to Admin/RoxyFileman/ProcessRequest because of Libraries/Nop.Services/Media/RoxyFileman/FileRoxyFilemanService.cs.

Affected Software

1 affected component

Nopcommerce NopCommerce=4.20

Event History

Dec 9, 2019

CVE Published

via MITRE·04:57 PM

Data Sourced

via MITRE·04:57 PM

Description

Frequently Asked Questions

What is the severity of CVE-2019-19683?

CVE-2019-19683 is considered to be of medium severity due to the potential for unauthorized access to sensitive files.

How do I fix CVE-2019-19683?

To fix CVE-2019-19683, update nopCommerce to a version beyond 4.2.0 or implement input validation to prevent path traversal.

What type of vulnerability is CVE-2019-19683?

CVE-2019-19683 is classified as a path traversal vulnerability due to its exploitation through directory traversal via user inputs.

Which software versions are affected by CVE-2019-19683?

CVE-2019-19683 affects nopCommerce version 4.2.0 specifically.

What actions are impacted by CVE-2019-19683 in nopCommerce?

CVE-2019-19683 allows attackers to traverse directories and access sensitive files through the RoxyFileman module.